The crates.io team and Rust security response working group (Rust Blog, 17 September 2026) warn of what they believe is an ongoing campaign against rust-lang members and owners of popular crates that tries to compromise devices and accounts in order to use them to publish malware. Lure: a video call set up for something positive (a job, a project or a contract opportunity) is used to get the target to install something, such as a purportedly missing audio codec, or to run another command, for example one placed on the clipboard.

The attackers set up new but legitimate-seeming company profiles, including plausible LinkedIn presences, to pass cursory inspection.

The post says a previous attack of this form targeted many prominent Rust developers in June, and that the month before the post, the arrayref crate was briefly compromised through similar attacks.

The Rust Blog says this attack style is known to be used by the DPRK and has been seen outside the Rust community, but that it does not know whether these attacks are all part of the same campaign. Guidance: be suspicious of cold outreach; hold calls on platforms you trust, ideally one you set up yourself on a platform you already use; re-check that MFA is enabled and there are no unexpected logins; contact help@crates.io for crates.io account concerns or security@rust-lang.org for others. (source: Rust Blog)

No CVE.

Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read, and a detail about the arrayref compromise that only SecurityWeek gave, and removed advice the Rust Blog post does not give; every detail now comes from the Rust Blog post, and the card date stays 17 September 2026, the post's date. (source: Rust Blog)